Permission Denied on NFS mount through SSH remote tunnel

Question

I successfully exported a directory from a CentOS 7 server to a CentOS 6 server(I used * in /etc/exports (as opposed to the server's IP). But I can't seem to find solutions that work for me to export it through SSH Tunnels. This is my current /etc/exports:

/dir localhost(insecure,rw,sync,no_subtree_check,no_root_squash,no_all_squash)

I made sure that the firewall wasn't blocking it:

[SERVER]# firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources:
  services: ssh dhcpv6-client nfs
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

On the client side, I set up a Remote tunnel with PuTTY by choosing a random Source port 7475 and Destination 10.2.10.14:2049(NFS Server IP and NFS port). The event log confirms that it worked:

2020-02-04 12:07:48 Requesting remote port 7475 forward to 10.2.10.14:2049
2020-02-04 12:07:48 Remote port forwarding from 7475 enabled

So here's what happens when I try to mount:

[CLIENT]# mount -v -t nfs -o port=7475 localhost:/dir /dest
mount.nfs: timeout set for Tue Feb  4 12:09:53 2020
mount.nfs: trying text-based options 'port=7475,vers=4,addr=127.0.0.1,clientaddr=127.0.0.1'
mount.nfs: mount(2): Permission denied
mount.nfs: access denied by server while mounting localhost:/dir

The PuTTY event log produces this output:

2020-02-04 12:07:31 Received remote port localhost:7475 open request from 127.0.0.1:962
2020-02-04 12:07:31 Attempting to forward remote port to 10.2.10.14:22
2020-02-04 12:07:31 Forwarded port opened successfully
2020-02-04 12:07:31 Forwarded port closed

Any ideas on how to get NFS to work here, or troubleshooting tips? I tried looking into tcpdump, but couldn't really understand the output. NOT looking for an sshfs solution.

Levi Uzodike · Answer 1 · 2020-02-06T18:16:12.870

Silly mistake on my part. I was following instructions from here, but it seems like(I don't fully understand local port forwarding) since mine was a Remote Tunnel and not a Local Tunnel like in the instructions, I had to change /etc/exports to say:

/dir *(insecure,rw,sync,no_subtree_check,no_root_squash,no_all_squash)

Probably not all of those were necessary. Somehow I thought that doing the SSH tunneling would masquerade the client to look like it was the NFS server, but it seems like it just reroutes, so that's why the exporting to localhost was denying access to the client server.

I thought this might be safe if the NFS was only exporting to those able to SSH tunnel to it. But since this isn't the case, this is too insecure for me since NFS seems to have no simple password protection, so I'll go with a samba share.

Permission Denied on NFS mount through SSH remote tunnel

1 Answers1